Quick Start Session For Using CPE Within the CVE Record Format

on YouTube ↗29m

" summary

CVE Record Format 5.1.1 adds a new cpeApplicability array that implements CPE Applicability Statements and matches NVD configurations so producers can express complex AND/OR product+platform logic (examples shown for Linux kernel branches and multi‑configuration .NET cases). CPE markup is optional today; older CPE lists remain for backward compatibility. Authors can add CPE data with CBE client or CBE lib after initial publishing; ecosystem tooling still needs updates to fully support the new structure.

AI-written summary · about

" chapters (10)

1. 0:00CPE and CVE record format
2. 1:45Including CPE in CVE records
3. 6:11CPE applicability language
4. 7:16CVE record format overview
5. 9:05NIST NVD configurations
6. 12:17Basic CPE applicability
7. 14:04Advanced CPE applicability examples
8. 18:25Complex CPE configurations
9. 20:10CPE in CNA tools
10. 21:56Q&A on CPE and future plans

" related talks

• 46mCVE Record Format - Purl and CPE WorkshopChris Coffin · CVE/FIRST VulnCon 2026 & Annual CNA Summit
• 33mCVE Decaf: Brewing Better and More Actionable Data QualityJay Jacobs, Jerry Gamblin · CVE/FIRST VulnCon 2026 & Annual CNA Summit
• 35mVulnrichment PlaygroundArt Manion, Lindsey Cerkovnik · CVE/FIRST VulnCon 2026 & Annual CNA Summit
• 45mFuture of CVEArt Manion · Global Security Vulnerability Summit @ Open Source Summit North America 2022
• 53mThe Trials and Tribulations of Bulk Converting CVEs to OSVAndrew Pollock · CVE/FIRST VulnCon 2024 & Annual CNA Summit
• 01h 00mThe CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability DataLindsey Cerkovnik, Alec Summers · CVE/FIRST VulnCon 2026 & Annual CNA Summit
• 57mThe CWE Program: Current State and Road AheadAlec Summers · CVE/FIRST VulnCon 2024 & Annual CNA Summit
• 26mConfig Based CVE Matching for Linux KernelTakuma Kawai · Critical Software Summit @ Open Source Summit Japan 2022